[Paper Review] A Predictable Incentive Mechanism for TrueBit

Julia Koch, Christian Reitwießner|arXiv (Cornell University)|Jun 29, 2018

Blockchain Technology Applications and Security1 references3 citations

TL;DR

This paper proposes a predictable incentive mechanism for TrueBit that replaces probabilistic forced errors with deterministic solver selection and proof of independent execution. By randomly selecting multiple bonded solvers who submit Merkle proofs of state snapshots, the protocol ensures verifiable, evenly shared rewards and eliminates the need for jackpots or token taxes, improving predictability and reducing reliance on speculative incentives.

ABSTRACT

TrueBit is a protocol that uses interactive verification to allow a resource-constrained computation environment like a blockchain to perform much larger computations than usual in a trusted way. As long as a single honest participant is present to verify the computation, an invalid computation cannot get accepted. In TrueBit, the presence of such a verifier is incentivised by randomly injected forced errors. Additionally, in order to counter sybil attacks, the reward for finding an error drops off exponentially with the number of challengers. The main drawback of this mechanism is that it makes it very hard to predict whether participation will be profitable or not. To even out the rewards, we propose to randomly select multiple solvers from a pool and evenly share the fees among them, while still allowing outside challengers. Furthermore, a proof of independent execution will make it harder to establish computation pools which share computation results.

Motivation & Objective

• To address the unpredictability of rewards in the original TrueBit protocol, which relies on probabilistic forced errors and exponential reward decay.
• To eliminate the need for a native Truebit token, taxes, and jackpot mechanisms by replacing them with a deterministic, scalable incentive structure.
• To enhance resistance against collusion and pooling by requiring proof of independent execution via Merkle trees with secret-protected state snapshots.
• To allow task givers to customize security levels per task by selecting the number of solvers, enabling fine-grained control over verification cost and reliability.
• To improve economic incentives for honest verification by ensuring steady, predictable rewards instead of high-variance, lottery-like payouts.

Proposed method

• Selecting k ≥ 2 solvers randomly from a pool of bonded, available participants for each computation task.
• Requiring each solver to generate and submit a Merkle tree of state snapshots, with each leaf incorporating a private secret (H(s,p)) to ensure uniqueness.
• Storing only the solution hash H(s,p,y), the root r, and a random Merkle proof pr(r) to a leaf at index (1 + r % n) on the blockchain.
• Allowing outside challengers to verify solvers' work, with rewards decreasing exponentially with the number of challengers to prevent Sybil attacks.
• Enabling verification games if solvers disagree, with the blockchain resolving disputes using the Merkle proofs and state snapshots.
• Requiring all solvers to submit their private randomness H(s,p) after a timeout, enabling verification of their independent execution.

Experimental results

Research questions

• RQ1 How can the unpredictability of rewards in TrueBit’s original incentive mechanism be mitigated to improve participant incentives?
• RQ2 Can a deterministic solver selection and proof-of-independent-execution mechanism replace probabilistic forced errors without compromising security?
• RQ3 To what extent does requiring Merkle proofs of state snapshots prevent collusion and result-sharing among solvers?
• RQ4 How does the proposed mechanism affect the economic incentives for forming verification pools compared to the original protocol?
• RQ5 What is the trade-off between increased computational cost for solvers and the elimination of token-based incentives and tax mechanisms?

Key findings

• The proposed protocol ensures that the probability of an invalid solution being accepted is at most 2.8% in the case of two solvers, and less than 0.46% for three solvers, matching or exceeding the security of the original protocol.
• The protocol removes the need for forced errors, jackpots, and native tokens, simplifying the economic model and improving predictability for participants.
• Proof of independent execution via Merkle trees with secret-protected state snapshots prevents solvers from sharing results or forming collusion pools.
• Task givers can now select the number of solvers per task to tailor security levels independently, enabling cost-security trade-offs without relying on global tax rates.
• The protocol reduces the incentive for forming 'insurance pools' by replacing high-variance, lottery-like rewards with stable, predictable income for honest solvers.
• Despite higher per-solver computational costs due to proof generation, the protocol achieves comparable or better security with fewer verifiers—e.g., 3 solvers in the new model match the security of 6 verifiers in the original model under the same assumptions.